Building operational resilience in the financial sector

On Monday 29 March the UK supervisory authorities – the Prudential Regulation Authority (PRA), the Financial Conduct Authority (FCA) and the Bank of England – released their long-awaited policy statements on operational resilience. Operational resilience professionals across the UK will have now had a full three days to process, interpret and analyse the documents –  all 14 of them. At UK Finance, we read with interest to determine how well the positions and recommendations made on behalf of the industry had been received. Below we set out some detail to the elements in the statements and outline where the authorities have landed their positions with respect to the most important parts of the regulations.

Perhaps most importantly we should start with timelines. Firms have between now and 31 March 2022 to implement the policy. This is followed by a further period in which firms will need to evidence that they can stay within tolerance for their most important business services.

With that in mind, the following detail will be useful for  businesses as they progress through their respective regulations:

1. Important business services: UK authorities have made a minor change to the definition for an important business service, in that it only refers to “intolerable levels of harm” to consumers and not to “intolerable levels of risk” to market integrity. This change ensures alignment across the supervisory authorities.
2. Impact tolerances: The authorities are proceeding with original proposals largely as consulted on with some minor changes and clarifications. Time/duration has been confirmed as a mandatory metric to measure impact tolerances. The authorities are maintaining the position that dual-regulated firms could be subject to more than one impact tolerance for their important business services.
3. Mapping: The authorities have acknowledged the UK Finance position that mapping is one of the most resource intensive elements and have applied some proportionality in this area. The expectation is that firms only need to carry out initial mapping by 31 March 2022. This should be to a level of sophistication necessary to identify important business services, set impact tolerances, and identify any vulnerabilities in their operational resilience.
4. Scenario testing: The authorities have provided further guidance to make testing expectations clearer. The expectation is that firms only need to carry out scenario testing – by 31 March 2022 – to a level of sophistication necessary to identify important business services, set impact tolerances and identify any vulnerabilities in their operational resilience. Firms also have the ability to apply proportionality here by only testing a portion of the important business services.  
5. Self-assessment: The authorities have confirmed they will not provide a format for the self-assessment on the grounds that the implementation of a format or template would go against the proportionality principle and create an unnecessarily prescriptive mapping process, which they see as a good example of a proportionate approach.

On 13 April we will begin our series of events for operational resilience with a webinar hosted in conjunction with the Financial Conduct Authority (FCA). This session will allow members to hear from the FCA as to its final policy and rules around building operational resilience. This keynote will provide a view of the new standards in greater detail and look at how feedback to the consultation has shaped the regulator’s approach. If you would like to join the session, please register via this link.

We look forward to working with our members and regulators as we enter the implementation period. Members will be contacted in the coming weeks about further events and opportunities to be involved in shaping the work of operational resilience at UK Finance